Wireless Profile Permissions

[MoBogomips]

We have a requirement on our laptops that the Admin user will create a fixed set of wireless profiles but non-Admin users cannot add/remove/modify them.

We can't find a way to keep these profiles locked down so that the users cannot change them. Is there a way to do this with Windows 7 Enterprise? Group Policy perhaps? Thanks!

 

[iAmDan]

Are you using any Server OS?

 

[MoBogomips]

No Server OS. We have to do this using only the laptop Win7 resources.

 

[kegobeer]

I believe you can lock down network configurations by using the group policy editor. You should find options under user configuration -> administrative templates -> network -> network connections.

 

[MoBogomips]

Good suggestion but I can't seem to find the right policy. I've tried Prohibiting Access to properties of a LAN connection and Disabled the Ability to Enable/Disable a LAN Connection but they don't prohibit modification of the Wireless profiles.

I haven't found a Group Policy with the term "Wireless" in its name. If only I could hide the Manage Wireless Networks page from non-Admin users.

 

[kegobeer]

You can create your own policy about wireless. This article should help.

Using GPO to lock down Wifi on a workstation - Powershell.CA

 

[MoBogomips]

Thanks for the link. I can't seem to find the Wireless Network Policy item under Security settings. It looks like the example might be from a Domain Service policy editor and not a local Win7 editor?

However, the items in that policy got me looking more into using netsh wlan commands. It looks like there are commands for many of the check boxes that the policy editor user interface provides (prevent ad-hoc connections, view denied networks, etc).

Using netsh I can disable users from creating user profiles but not modifying them. I'm taking a look at the netsh command reference now to see if there is another setting to disable user modification.

 

[kegobeer]

After doing a lot of reading, it doesn't look like you can lock down the wireless policy unless you are running a server with active directory, and you push out policies using the GPO. If you have Intel wireless cards, you might be able to install the ProSet Wireless software and set passwords that will prevent profile changes.

 

[barcobus]

I have a workstation that is locked down after being removed from a Domain that I don't have access to. The Laptop still does not allow any Wifi networks to be joined. There are no local policies set to do this. Anyone know how to remove this?

 

[kegobeer]

I have a workstation that is locked down after being removed from a Domain that I don't have access to. The Laptop still does not allow any Wifi networks to be joined. There are no local policies set to do this. Anyone know how to remove this?

It sounds like the computer is still part of the domain. Even if the computer is not connected to the domain, the domain rules remain in effect until the computer is becomes a member of the workgroup. If you don't have the permissions to leave the domain, you need to take the computer back to the system admin and have him/her do it.